Getting Data In

What is the precedence for identical stanzas within a single conf file? Is this a valid configuration?

mlorch
Path Finder

Hi,

I'm facing the situation that there is the identical stanza twice within a single conf file.
E.g.
authorize.conf

[role_admin]
srchIndexesDefault = main

[role_admin]
srchIndexesDefault = _internal

I know the documentation for Attribute precedence within a single props.conf file, but this only describes the precedence defined by ASCII order. Not if the stanza is identical.

Verifying the configuration with btool, I get that the last listed entry rules. Which makes sense.

So my question is: Is this a valid configuration (despite the fact that this should be avoided)?

Thanks and best regards,
Max.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If it wasn't valid, btool would have flagged it. As you say, this situation should be avoided.

---
If this reply helps you, Karma would be appreciated.

mlorch
Path Finder

Thanks. That's what I expected.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...